December 2003 - cypherpunks-legacy

Re: Truelly Random Numbers
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim Fulbright wrote: > > Now I, a lurker for two months, am truelly confused! L. Deitweiler must be > right. Surely one of you cyperpunk fellows could hack together a dongle with > some kind of AD converter and buffer ram to gather a Truelly Random Bitstream > off the environment every couple of milliseconds easier than this raindrop > scheme or recording the fan, you're haviung me on!. Let's go back [..] The raindrop scheme was (politely) laughed off. As for the fan recording scheme, it's a good make-do-with-what-you-already-have method, as opposed to buying and/or building a card. A 'simple AD converter' isn't so simple. Especially if you want to be sure you really have random noise and not something else that just looks random. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTz0nSoZzwIn1bdtAQGl6QF+P1V62qg+Mf5K+VN3q0Y1e6/A4EO4uLLr WNxAbtE+OxQXFKnP7ajFUFBbnDLJxLmx =4ysY -----END PGP SIGNATURE-----

1 0

Re: (Fwd) Gov't run anon servers
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Hal Finney writes: >From: mccoy(a)communities.com (Jim McCoy) [...] >> The point is not to make a system which is absolutely, positively, no >> doubt about it, secure against any attacker. If cypherpunks could do >> this they would be working for defense contractors and others who make >> certified systems. The objective is to make a system which is difficult >> to attack, one which costs the attacker time/money. [...] > >I was speaking of present conditions. If and when proven-secure Unix >systems start being used as remailer servers on the net then it may be >worthwhile having a larger key. You are correct in stating that having a huge key on a remailer is as silly as putting a $500 lock on a door made of balsa wood. OTOH, the key selected is vulnerable from attacks which you cannot protect yourself against. No amount of detailed security analysis for a host is going to prevent someone else from factoring the keys, and there is nothing that can be done to prevent this from happening. To prevent this is seesm reasonable to select a key which is at least somewhat outside the range of most attackers, 510 bits seems to be pushing the lower bounds of this range a bit (while more than 1024 is probably useless overkill.) With fairly decent logging and auditing at least you know that you have been screwed when it comes to standard system break-ins, you do not know that you have a problem when your key is factored. [...] >> The unix hosts running remailers also have the advantage in >> that they have been subjected to attack for quite a while now and >> most of the obvious problems (and some of the non-obvious problems) >> have been fixed. > >I am not sure what you mean by this. My experience is that new CERT >advisories come out every few months which represent security holes big >enough to steal remailer keys. Well, most of the announcements in the past year have been attacks through subsystems which a remailer should not be running in the first place (e.g. the recent chargen/daytime/etc attacks.) The fact that the announcements come out in the first place is a "good thing" because it makes you aware of the problem. The timid will then think that the system which is the subject of the announcement is insecure and place their trust in a system which is not under the same sort of public scrutiny (e.g. Windows NT, or a VM/CMS system) but which is even easier to hack. At least people are aware of security issues on Unix hosts... (a quick walk through a Computer Literacy bookstore last night turned up twelve books on Unix/internet-server security and none dealing specifically with Windoze95 or NT security, does that mean that my NT test box is perfectly secure? :) Otherwise, I agree that assuming you have a secure remailer just because you use a big key is a foolish attitude. jim

1 0

FCC and Internet telephones
by Ernest Hua 17 Dec '03

17 Dec '03

Dost my ears deceive me? Is this true? Ern -------- INCLUDED MESSAGE FCC Asked to Stop Net Phones A trade association of long distance phone service carriers has asked the Federal Communications Commission to halt companies from selling software and hardware products that enable use of the Internet for long distance voice services. In a statement from Washington, the America's Carriers Telecommunication Association says it "submits that it is incumbent upon the FCC to exercise jurisdiction over the use of the Internet for unregulated interstate and international telecommunications services." A growing number of companies sell such software with ancillary hardware for transmitting and receiving voice over the Net, which, says the statement, "creates the ability to 'by-pass' local, long distance and international carriers and allows for calls to be made for virtually 'no cost.'" "For example," adds the ACTA statement, "online service providers generally charge users around $10 for five hours of access and then around $3 for each additional hour. Five hours equals 300 minutes, divided by $10 is 3.3 cents per minute. The average residential long distance telephone call costs about 22 cents per minute or seven times as much." Long-distance and international telephone service carriers must be approved by the FCC to operate and must file tariffs before both the FCC and state public service commissions. All of these requirements are stipulated in the Communications Act of 1934 and the Telecommunications Act of 1996. Says ACTA, "Technology may once again be surpassing government's ability to control its proper use. However, the misuse of the Internet as a way to 'by-pass' the traditional means of obtaining long distance service could result in a significant reduction of the Internet's ability to transport its ever enlarging amount of data traffic." Specifically, ACTA petitions the FCC to define the type of permissible communications that may be effected over the Internet.

1 0

Re: Boycott "Applied Cryptography" and AT&T and RSA
by shabbir＠vtw.org 17 Dec '03

17 Dec '03

VTW supports the Leahy/Goodlatte bill, since it helps to free lots and lots of cryptography that is currently being crushed under the weight of the Clinton Administration's cryptography export regulations. -Shabbir J. Safdar * Online Representative * Voters Telecomm. Watch (VTW) http://www.vtw.org/ * Defending Your Rights In Cyberspace PS AT&T makes so much money in a year that if everyone on cypherpunks switched to Sprint, it still probably wouldn't even put a dent in their annual budget for paperclips. anonymous-remailer(a)shell.portal.com writes: >Bruce Schnier (Author of applied cryptography) and Matt Blaze (Who >is a crypto bigwig at at&t) have made it clear that they support >key escrow. Both have written letters in favor of the new crypto >law, it creates a key escrow system and also other restricts on >crypto. The letters are on the CDT homepage and i think were >posted here. > >WHAT THE FUCK?????????????????????????????????????????? > >EFF, EPIC, VTW and almost everyone else (except for Bizdos at RSA, hmmmm) >have all come out against this piece of shit. But with these so called >experts baking it it could pass anyway. > >Maybe the ltrs are a forgery? We should ask them, and if this is true, LETS >SEND THEM A MESSAGE!!!!!!!! SWITCH YOUR PHONE SERVICE AND TELL AT&T WHY!!! >STOP RECOMMENDING APPLIED CRYPTO (THERE ARE EASIER BOOKS ANYWAY). DEMAND >THAT THESE PEOPLE STOP GIVING AWAY YOUR RIGHTS!!!!!!!!!!!!!!!!!!!!!!!!!!! > >their addresses are > schneier(a)counterpane.com > mab(a)crypto.com > jim(a)rsa.com >

1 0

Re: Jump Start ecash With IPhone
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Duncan Frissell writes: >At 11:37 AM 3/6/96 -0800, Jim McCoy wrote: >> 2- The phone companies (actually ACTA, the telco lobby) petitioned >> the FCC on Monday to regulate the Internet phone software >> companies. >> >>IP phone systems themselves may need to move underground just to >>escape regulation. OTOH, there is nothing to prevent people from >>building their own systems once some free software is out there... > >That would be a super neat trick since the LD business is currently >deregulated (and in fact was never a government monopoly) and the local loop >is in the process of deregulation, and Vocaltec is in some senses an Israeli >company anyway and need not have a presence in New Jersey if it doesn't >want do. > The regulation in question was regarding things like local/state/federal telecom taxes and levies, and all of the BS hoops that LD carriers must jump through. Regarding where such companies are located, I am also at a loss as to how this recent action will be enforced; that does not necessarily mean that a bureaucrat somewhere will not try to do something stupid. Just because LD is "deregulated" does not mean that it is without any governmental oversight, much as I wish it were... LD companies still have to pay certain taxes (take a look at your next phone bill, they are clearly listed in addition to your actual phone charges) and I am certain that they have entire office buildings stuffed with drones filling out paperwork for Uncle Sam... jim

1 0

DNSSEC (was: A brief comparison of email encryption protocols)
by Donald E. Eastlake 3rd 17 Dec '03

17 Dec '03

On Tue, 5 Mar 1996, Carl Ellison wrote: > Date: Tue, 5 Mar 1996 00:34:41 -0500 > >From: Adam Shostack <adam(a)homeport.org> > >Subject: Re: A brief comparison of email encryption protocols > >To: ericm(a)lne.com (Eric Murray) > >Date: Mon, 4 Mar 1996 21:18:41 -0500 (EST) > >Cc: ericm(a)lne.com, perry(a)piermont.com, cme(a)cybercash.com, warlord(a)mit.edu, > > lgl(a)qualcomm.com, Cypherpunks(a)toad.com > > ... > > > >| Along those lines, I was envisioning adding a KEY RR type to > >| DNS, and using it to maintain pointers to keyservers. > > > >[...] > >| This sounds so obvious that I'm sure that I'm not the first > >| or even the tenth person to think of it, and in fact I > >| see a KEY RR type defined in the BIND 4.9.3BETA17 source. But > >| there's just a type there, nothing else to support it. > >| Anyone know what it's for? > > > > Donald Eastlake is writing the spec for storing keys in > >nameservers. Its in the process of moving to draft standard; there > >will probably be something about it after LA. I think its: > > > >ftp://ds.internic.net/draft-ietf-dnssec-secext-09.txt actually its in /internet-drafts/draft-ietf-dnssec-secext-09.txt on any of the IETF shadow directory machines such as ftp.isi.edu or ds.internic.net via ftp. It's up for Internet Proposed Standard and tehre were no objections at the DNSSEC working group meeting this morning. It provides for KEY RRs and SIG (signature) RRs. I recommend people check it out. > >Adam > > > >-- > >"It is seldom that liberty of any kind is lost all at once." > > -Hume > +--------------------------------------------------------------------------+ > |Carl M. Ellison cme(a)cybercash.com http://www.clark.net/pub/cme | > |CyberCash, Inc., Suite 430 http://www.cybercash.com/ | > |2100 Reston Parkway PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 | > |Reston, VA 22091 Tel: (703) 620-4200 | > +--------------------------------------------------------------------------+ Donald ===================================================================== Donald E. Eastlake 3rd +1 508-287-4877(tel) dee(a)cybercash.com 318 Acton Street +1 508-371-7148(fax) dee(a)world.std.com Carlisle, MA 01741 USA +1 703-620-4200(main office, Reston, VA) http://www.cybercash.com http://www.eff.org/blueribbon.html

1 0

Boycott "Applied Cryptography" and AT&T and RSA
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Bruce Schnier (Author of applied cryptography) and Matt Blaze (Who is a crypto bigwig at at&t) have made it clear that they support key escrow. Both have written letters in favor of the new crypto law, it creates a key escrow system and also other restricts on crypto. The letters are on the CDT homepage and i think were posted here. WHAT THE FUCK?????????????????????????????????????????? EFF, EPIC, VTW and almost everyone else (except for Bizdos at RSA, hmmmm) have all come out against this piece of shit. But with these so called experts baking it it could pass anyway. Maybe the ltrs are a forgery? We should ask them, and if this is true, LETS SEND THEM A MESSAGE!!!!!!!! SWITCH YOUR PHONE SERVICE AND TELL AT&T WHY!!! STOP RECOMMENDING APPLIED CRYPTO (THERE ARE EASIER BOOKS ANYWAY). DEMAND THAT THESE PEOPLE STOP GIVING AWAY YOUR RIGHTS!!!!!!!!!!!!!!!!!!!!!!!!!!! their addresses are schneier(a)counterpane.com mab(a)crypto.com jim(a)rsa.com

4 3

Re: Boycott "Applied Cryptography" and AT&T and RSA
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

>Bruce Schnier (Author of applied cryptography) and Matt Blaze (Who >is a crypto bigwig at at&t) have made it clear that they support >key escrow. Both have written letters in favor of the new crypto >law, it creates a key escrow system and also other restricts on >crypto. The letters are on the CDT homepage and i think were >posted here. Whoever wrote this crap is an idiot. In the preface of Applied Cryptography, (Page xx) on the subject of government key escrow, Schneier states: "Some dangerously Orwellian assumptions are at work here: that the government has the right to listen to private communications and that there is something wrong with a private citizen trying to keep a secret from the government. ...this is the first time people have been forced to make themselves available for surveillance. These initiatives are not simple government proposals in some obscure area; they are pre-emptive and unilateral to usurp powers that previously belonged to the people. Clipper and Digital Telephony do not protect privacy; they force individuals to unconditionally trust that the government will respect their privacy. ... The lesson here is that it is insufficient to protect ourselves with laws; we need to protect ourselves with mathematics. Encryption is too important to be left solely to governments." Schneier goes on to state that the purpose of the book is to ensure that people will have access to strong crypto, even if it is outlawed. It is hard to interpret this as support for government key escrow. Check your facts before slandering people. Jonathan Wienke

1 0

Re: Jump Start ecash With IPhone
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:26 AM 3/6/96 -0500, "Declan B. McCullagh" <declan+(a)CMU.EDU> wrote: >WASHINGTON, March 4 /PRNewswire/ -- The America's Carriers >Telecommunication Association (ACTA), a trade association of >competitive, long distance carriers today petitioned the Federal >Communications Commission (FCC) to stop companies from selling >software and hardware products that enable use of the Internet to >voice long distance services. .... >CONTACT: Charles H. Helein, general counsel, 703-714-1301, or Jennifer Durst- >Jarrell, executive director, 407-332-9382, both of America's Carriers >Telecommunication Association Their complaint was that Internet time, at $2/hour, is 3.3 cents/minute, far cheaper than the 22 cents/minute many of them are charging. (The real price is, of course, double that, 6.6cents, because both ends of the connection need Internet connections.) I assume they're hoping that the FCC won't know that the "hardware and software products" are the sound cards that almost every new PC sells with and software ranging from $50 down to free, and offers encryption which they don't, as well as voice quality ranging from worse to much worse to better. Some of the software works over the Internet, some chooses to get better voice quality over direct modem connections (which use their services.) They're also sleazing over the issue that many businesses are using low-bit-rate voice on their private networks to squeeze more voice calls into the networks they buy at bulk rates, most of which are billed at rather less that 22 cents/minute. If you're fitting four 16kbps calls into the 64kbps standard voice circuit, and you're paying 12 cents/minute, that's 3 cents/minute/call. And _really_ big bulk-buying customers are paying a lot less than 22 cents - I read in the papers that the Federal Telephone System is under 5 cents/minute. Bill Stewart P.S. Yes, I work for one of their competitors, though I'm not in the voice business, and not speaking for my employer. Aside from being a concerned citizen, and a voice telephone service customer who objects to companies that try to use the government to stomp their competitors instead of competing against them freely, I'm also an Internet user. Yes, the Internet is providing lots of new and exciting communications possibilities, and if you're worried that people are going to use the Internet for low-cost un-wiretappable encrypted phone calls that sound worse than ham radio and allow folks in third-world countries to better afford communications, go into the Internet business yourself. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 #

1 0

Re: art-stego
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- JonWienke(a)aol.com wrote: > Another thing--just a wild idea--test the randomness of encrypted data > storing it in an 8-bit mono .WAV (your choice of sample rates) file and > listening to it. Any correlations or patterns in the data should show > the playback as hums, clicks, squeals, or something. It may even be > to determine the algorithm by the sound patterns--a sort of "audio > cryptanalysis." Has anyone tried this? Are there any .WAV stego > out there? s-tools is an audio stego utility(s), but I've not used it. As for testing methods, noise spheres are an interesting graphical method for testing randomness (check the archives from late Dec/early Jan, I posted a short Turbo Pascal program that implements them). I'm not entirely sure if noise spheres will capture any crypto-relevant correlations, but it seems worth investigating. The reference to the article on noise spheres and other graphical methods for testing PRNGs is: Pickover, Clifford A. 1995. "Random number generators: pretty good ones are easy to find." The Visual Computer (1995) 11:369-377. - --Rob - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTwF5ioZzwIn1bdtAQG/ogF5AdudaHeEb+b2eOWs/XA3ZCIYGKrW1alg abs4UNS5OC2jjqr5UPfrVq5LB8lMwLS7 =OjB4 -----END PGP SIGNATURE-----

1 0